It is generally suggested that CSRF tokens are applied to login forms to prevent session donation attacks. The idea is that you can trick a user into visiting a link, and they become logged in under an account that you control. They then perform some action involving storing some secret information to the account, without noticing they're logged in as you, and that gets saved to your account.
A simple example might be a file upload site. If you can trick them into being logged in as you, they might upload a sensitive file into your account rather than theirs, and you can then steal that file.
For Wordpress this probably isn't so big a deal, because it's not particularly applicable to the functionality that Wordpress provides, and the wp-admin panel isn't really a "general user" area that an attacker would have a valid account for.